chore(deps): update and pin backend dependencies

.npmrc

@@ -0,0 +1 @@
+save-exact=true

README.md

@@ -52,9 +52,12 @@ PR и ежедневно. `.gitleaksignore` перечисляет только
 Новые коммиты этими исключениями не покрываются.
 
 Renovate группирует minor/patch updates, а major требует согласования в
-Dependency Dashboard. Автоматический merge не включён. Overrides в
-`package.json` закрывают advisories транзитивных `multer`, `deepmerge-ts`,
-`mysql2` и `js-yaml`; удаляйте их, когда родительские пакеты примут исправленные
+Dependency Dashboard. Автоматический merge не включён. Прямые зависимости
+фиксируются точными версиями: `.npmrc` задаёт `save-exact=true` для npm install,
+Renovate использует `rangeStrategy: pin`. Обновляйте `package.json` вместе с
+`package-lock.json`. Overrides в
+`package.json` закрывают advisories транзитивных `multer`, `deepmerge-ts` и
+`mysql2`; удаляйте их, когда родительские пакеты примут исправленные
 версии. Совместимость Prisma override проверяется генерацией и SQLite migrations.
 Required checks настраиваются отдельно в Gitea: наличие workflow само по себе
 не блокирует merge.

package.json

@@ -31,68 +31,65 @@
     "verify": "npm run lint && npm run typecheck:app && npm run typecheck:test && npm test -- --runInBand && npm run build"
   },
   "dependencies": {
-    "@grpc/grpc-js": "^1.14.4",
-    "@grpc/proto-loader": "^0.8.1",
-    "@nestjs/common": "^11.0.1",
-    "@nestjs/config": "^4.0.4",
-    "@nestjs/core": "^11.0.1",
-    "@nestjs/jwt": "^11.0.2",
-    "@nestjs/passport": "^11.0.5",
-    "@nestjs/platform-express": "^11.0.1",
-    "@nestjs/swagger": "11.4.5",
-    "@prisma/adapter-better-sqlite3": "^7.9.1",
-    "@prisma/client": "^7.9.1",
-    "bcrypt": "^6.0.0",
-    "better-sqlite3": "^12.6.0",
-    "cheerio": "1.1.2",
-    "class-transformer": "^0.5.1",
-    "class-validator": "^0.15.1",
-    "cookie-parser": "^1.4.7",
-    "lru-cache": "^11.2.4",
-    "nestjs-pino": "^4.6.1",
-    "passport": "^0.7.0",
-    "passport-jwt": "^4.0.1",
-    "pino-http": "^11.0.0",
-    "reflect-metadata": "^0.2.2",
-    "rxjs": "^7.8.1"
+    "@grpc/grpc-js": "1.14.4",
+    "@grpc/proto-loader": "0.8.1",
+    "@nestjs/common": "11.2.3",
+    "@nestjs/config": "4.0.4",
+    "@nestjs/core": "11.2.3",
+    "@nestjs/jwt": "11.0.2",
+    "@nestjs/passport": "11.0.5",
+    "@nestjs/platform-express": "11.2.3",
+    "@nestjs/swagger": "11.4.7",
+    "@prisma/adapter-better-sqlite3": "7.10.0",
+    "@prisma/client": "7.10.0",
+    "bcrypt": "6.0.0",
+    "better-sqlite3": "12.11.1",
+    "cheerio": "1.2.0",
+    "class-transformer": "0.5.1",
+    "class-validator": "0.15.1",
+    "cookie-parser": "1.4.7",
+    "lru-cache": "11.5.2",
+    "nestjs-pino": "4.6.1",
+    "passport": "0.7.0",
+    "passport-jwt": "4.0.1",
+    "pino-http": "11.0.0",
+    "reflect-metadata": "0.2.2",
+    "rxjs": "7.8.2"
   },
   "devDependencies": {
-    "@eslint/eslintrc": "^3.2.0",
-    "@eslint/js": "^9.18.0",
-    "@nestjs/cli": "^11.0.0",
-    "@nestjs/schematics": "^11.0.0",
-    "@nestjs/testing": "^11.0.1",
-    "@types/bcrypt": "^6.0.0",
-    "@types/cookie-parser": "^1.4.10",
-    "@types/express": "^5.0.0",
-    "@types/jest": "^30.0.0",
-    "@types/node": "^24.13.3",
-    "@types/passport-jwt": "^4.0.1",
-    "@types/supertest": "^6.0.2",
-    "eslint": "^9.18.0",
-    "eslint-config-prettier": "^10.0.1",
-    "eslint-plugin-prettier": "^5.2.2",
-    "globals": "^16.0.0",
-    "jest": "^30.0.0",
-    "prettier": "^3.4.2",
-    "prisma": "^7.9.1",
-    "source-map-support": "^0.5.21",
-    "supertest": "^7.0.0",
-    "ts-jest": "^29.2.5",
-    "ts-loader": "^9.5.2",
-    "ts-node": "^10.9.2",
-    "tsconfig-paths": "^4.2.0",
-    "typescript": "^5.7.3",
-    "typescript-eslint": "^8.20.0"
+    "@eslint/eslintrc": "3.3.7",
+    "@eslint/js": "9.39.5",
+    "@nestjs/cli": "11.0.24",
+    "@nestjs/schematics": "11.1.0",
+    "@nestjs/testing": "11.2.3",
+    "@types/bcrypt": "6.0.0",
+    "@types/cookie-parser": "1.4.10",
+    "@types/express": "5.0.6",
+    "@types/jest": "30.0.0",
+    "@types/node": "24.13.4",
+    "@types/passport-jwt": "4.0.1",
+    "@types/supertest": "6.0.3",
+    "eslint": "9.39.5",
+    "eslint-config-prettier": "10.1.8",
+    "eslint-plugin-prettier": "5.5.6",
+    "globals": "16.5.0",
+    "jest": "30.5.1",
+    "prettier": "3.9.6",
+    "prisma": "7.10.0",
+    "source-map-support": "0.5.21",
+    "supertest": "7.2.2",
+    "ts-jest": "29.4.12",
+    "ts-loader": "9.6.2",
+    "ts-node": "10.9.2",
+    "tsconfig-paths": "4.2.0",
+    "typescript": "5.9.3",
+    "typescript-eslint": "8.70.0"
   },
   "overrides": {
-    "@nestjs/swagger@11.4.5": {
-      "js-yaml": "5.2.3"
-    },
     "@nestjs/platform-express": {
       "multer": "2.3.0"
     },
-    "@prisma/config@7.9.1": {
+    "@prisma/config@7.10.0": {
       "deepmerge-ts": "8.0.2"
     },
     "prisma": {
@@ -117,8 +114,8 @@
     "testEnvironment": "node"
   },
   "allowScripts": {
-    "@prisma/engines@7.9.1": true,
-    "prisma@7.9.1": true,
+    "@prisma/engines@7.10.0": true,
+    "prisma@7.10.0": true,
     "bcrypt@6.0.0": true,
     "better-sqlite3@12.11.1": true,
     "fsevents@2.3.3": true,

renovate.json

@@ -9,7 +9,7 @@
     "dependencies"
   ],
   "dependencyDashboard": true,
-  "rangeStrategy": "bump",
+  "rangeStrategy": "pin",
   "packageRules": [
     {
       "matchUpdateTypes": [